gemini-cli

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The skill explicitly supports fetching and ingesting arbitrary public web content (e.g., built-in tools "web_fetch" and "google_web_search" in references/commands.md, the "@https://..." reference syntax and examples like "Summarize @https://github.com/org/repo/README.md", plus installing extensions from arbitrary URLs and MCP servers with httpUrl in references/mcp-and-extensions.md), and those fetched third‑party contents are loaded into prompts and used to drive tool actions (including auto-approve flows), enabling indirect prompt injection.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill explicitly permits fetching and executing external content at runtime — e.g., "gemini extensions install https://github.com/GoogleCloudPlatform/cloud-run-mcp" and the @https://... file-reference (e.g., @https://github.com/org/repo/README.md) patterns fetch remote files that can inject GEMINI.md prompts or install/run MCP server code (via npx/node), so external URLs can directly control prompts or execute code.